To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 777
- compare with another revision
- download diff
- download tarball
- view history from revision 777
- Committer: Teddy Hogeborn
- Date: 2015-07-20 03:03:33 UTC
- Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.
The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string. This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:
SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256
* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
(/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.
The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string. This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:
SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256
* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
(/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- files modified:
- DBUS-API
added
removed
mandos-ctl
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
3
#
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
#
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
8
#
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
5
#
6
# Copyright © 2008-2015 Teddy Hogeborn
7
# Copyright © 2008-2015 Björn Påhlsson
8
#
9
# This program is free software: you can redistribute it and/or modify
10
# it under the terms of the GNU General Public License as published by
13
11
# the Free Software Foundation, either version 3 of the License, or
14
12
# (at your option) any later version.
15
13
#
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# This program is distributed in the hope that it will be useful,
15
# but WITHOUT ANY WARRANTY; without even the implied warranty of
18
16
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19
17
# GNU General Public License for more details.
20
#
18
#
21
19
# You should have received a copy of the GNU General Public License
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
#
20
# along with this program. If not, see
21
# <http://www.gnu.org/licenses/>.
22
#
24
23
# Contact the authors at <mandos@recompile.se>.
25
#
24
#
26
25
27
26
from __future__ import (division, absolute_import, print_function,
28
27
unicode_literals)
39
38
import re
40
39
import os
41
40
import collections
42
import json
43
import unittest
44
import logging
41
import doctest
45
42
46
43
import dbus
47
44
48
# Show warnings by default
49
if not sys.warnoptions:
50
import warnings
51
warnings.simplefilter("default")
52
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
format="%(message)s") # Show basic log messages
56
57
logging.captureWarnings(True) # Show warnings via the logging system
58
59
45
if sys.version_info.major == 2:
60
46
str = unicode
61
47
62
48
locale.setlocale(locale.LC_ALL, "")
63
49
50
tablewords = {
51
"Name": "Name",
52
"Enabled": "Enabled",
53
"Timeout": "Timeout",
54
"LastCheckedOK": "Last Successful Check",
55
"LastApprovalRequest": "Last Approval Request",
56
"Created": "Created",
57
"Interval": "Interval",
58
"Host": "Host",
59
"Fingerprint": "Fingerprint",
60
"CheckerRunning": "Check Is Running",
61
"LastEnabled": "Last Enabled",
62
"ApprovalPending": "Approval Is Pending",
63
"ApprovedByDefault": "Approved By Default",
64
"ApprovalDelay": "Approval Delay",
65
"ApprovalDuration": "Approval Duration",
66
"Checker": "Checker",
67
"ExtendedTimeout": "Extended Timeout"
68
}
69
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
64
70
domain = "se.recompile"
65
71
busname = domain + ".Mandos"
66
72
server_path = "/"
67
73
server_interface = domain + ".Mandos"
68
74
client_interface = domain + ".Mandos.Client"
69
version = "1.8.3"
70
71
72
try:
73
dbus.OBJECT_MANAGER_IFACE
74
except AttributeError:
75
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
75
version = "1.6.9"
76
76
77
77
78
78
def milliseconds_to_string(ms):
79
79
td = datetime.timedelta(0, 0, 0, ms)
80
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
81
.format(days="{}T".format(td.days) if td.days else "",
82
hours=td.seconds // 3600,
83
minutes=(td.seconds % 3600) // 60,
84
seconds=td.seconds % 60))
80
return ("{days}{hours:02}:{minutes:02}:{seconds:02}".format(
81
days = "{}T".format(td.days) if td.days else "",
82
hours = td.seconds // 3600,
83
minutes = (td.seconds % 3600) // 60,
84
seconds = td.seconds % 60))
85
85
86
86
87
87
def rfc3339_duration_to_delta(duration):
88
88
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
89
89
90
90
>>> rfc3339_duration_to_delta("P7D")
91
91
datetime.timedelta(7)
92
92
>>> rfc3339_duration_to_delta("PT60S")
93
93
datetime.timedelta(0, 60)
94
94
>>> rfc3339_duration_to_delta("PT60M")
95
95
datetime.timedelta(0, 3600)
96
>>> rfc3339_duration_to_delta("P60M")
97
datetime.timedelta(1680)
98
96
>>> rfc3339_duration_to_delta("PT24H")
99
97
datetime.timedelta(1)
100
98
>>> rfc3339_duration_to_delta("P1W")
103
101
datetime.timedelta(0, 330)
104
102
>>> rfc3339_duration_to_delta("P1DT3M20S")
105
103
datetime.timedelta(1, 200)
106
>>> # Can not be empty:
107
>>> rfc3339_duration_to_delta("")
108
Traceback (most recent call last):
109
...
110
ValueError: Invalid RFC 3339 duration: u''
111
>>> # Must start with "P":
112
>>> rfc3339_duration_to_delta("1D")
113
Traceback (most recent call last):
114
...
115
ValueError: Invalid RFC 3339 duration: u'1D'
116
>>> # Must use correct order
117
>>> rfc3339_duration_to_delta("PT1S2M")
118
Traceback (most recent call last):
119
...
120
ValueError: Invalid RFC 3339 duration: u'PT1S2M'
121
>>> # Time needs time marker
122
>>> rfc3339_duration_to_delta("P1H2S")
123
Traceback (most recent call last):
124
...
125
ValueError: Invalid RFC 3339 duration: u'P1H2S'
126
>>> # Weeks can not be combined with anything else
127
>>> rfc3339_duration_to_delta("P1D2W")
128
Traceback (most recent call last):
129
...
130
ValueError: Invalid RFC 3339 duration: u'P1D2W'
131
>>> rfc3339_duration_to_delta("P2W2H")
132
Traceback (most recent call last):
133
...
134
ValueError: Invalid RFC 3339 duration: u'P2W2H'
135
104
"""
136
105
137
106
# Parsing an RFC 3339 duration with regular expressions is not
138
107
# possible - there would have to be multiple places for the same
139
108
# values, like seconds. The current code, while more esoteric, is
140
109
# cleaner without depending on a parsing library. If Python had a
141
110
# built-in library for parsing we would use it, but we'd like to
142
111
# avoid excessive use of external libraries.
143
112
144
113
# New type for defining tokens, syntax, and semantics all-in-one
145
114
Token = collections.namedtuple("Token", (
146
115
"regexp", # To match token; if "value" is not None, must have
179
148
frozenset((token_year, token_month,
180
149
token_day, token_time,
181
150
token_week)))
182
# Define starting values:
183
# Value so far
184
value = datetime.timedelta()
151
# Define starting values
152
value = datetime.timedelta() # Value so far
185
153
found_token = None
186
# Following valid tokens
187
followers = frozenset((token_duration, ))
188
# String left to parse
189
s = duration
154
followers = frozenset((token_duration, )) # Following valid tokens
155
s = duration # String left to parse
190
156
# Loop until end token is found
191
157
while found_token is not token_end:
192
158
# Search for any currently valid tokens
215
181
216
182
217
183
def string_to_delta(interval):
218
"""Parse a string and return a datetime.timedelta"""
219
184
"""Parse a string and return a datetime.timedelta
185
186
>>> string_to_delta('7d')
187
datetime.timedelta(7)
188
>>> string_to_delta('60s')
189
datetime.timedelta(0, 60)
190
>>> string_to_delta('60m')
191
datetime.timedelta(0, 3600)
192
>>> string_to_delta('24h')
193
datetime.timedelta(1)
194
>>> string_to_delta('1w')
195
datetime.timedelta(7)
196
>>> string_to_delta('5m 30s')
197
datetime.timedelta(0, 330)
198
"""
199
220
200
try:
221
201
return rfc3339_duration_to_delta(interval)
222
except ValueError as e:
223
log.warning("%s - Parsing as pre-1.6.1 interval instead",
224
' '.join(e.args))
225
return parse_pre_1_6_1_interval(interval)
226
227
228
def parse_pre_1_6_1_interval(interval):
229
"""Parse an interval string as documented by Mandos before 1.6.1,
230
and return a datetime.timedelta
231
232
>>> parse_pre_1_6_1_interval('7d')
233
datetime.timedelta(7)
234
>>> parse_pre_1_6_1_interval('60s')
235
datetime.timedelta(0, 60)
236
>>> parse_pre_1_6_1_interval('60m')
237
datetime.timedelta(0, 3600)
238
>>> parse_pre_1_6_1_interval('24h')
239
datetime.timedelta(1)
240
>>> parse_pre_1_6_1_interval('1w')
241
datetime.timedelta(7)
242
>>> parse_pre_1_6_1_interval('5m 30s')
243
datetime.timedelta(0, 330)
244
>>> parse_pre_1_6_1_interval('')
245
datetime.timedelta(0)
246
>>> # Ignore unknown characters, allow any order and repetitions
247
>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')
248
datetime.timedelta(2, 480, 18000)
249
250
"""
251
202
except ValueError:
203
pass
204
252
205
value = datetime.timedelta(0)
253
206
regexp = re.compile(r"(\d+)([dsmhw]?)")
254
207
255
208
for num, suffix in regexp.findall(interval):
256
209
if suffix == "d":
257
210
value += datetime.timedelta(int(num))
268
221
return value
269
222
270
223
271
class TableOfClients(object):
272
tableheaders = {
273
"Name": "Name",
274
"Enabled": "Enabled",
275
"Timeout": "Timeout",
276
"LastCheckedOK": "Last Successful Check",
277
"LastApprovalRequest": "Last Approval Request",
278
"Created": "Created",
279
"Interval": "Interval",
280
"Host": "Host",
281
"Fingerprint": "Fingerprint",
282
"KeyID": "Key ID",
283
"CheckerRunning": "Check Is Running",
284
"LastEnabled": "Last Enabled",
285
"ApprovalPending": "Approval Is Pending",
286
"ApprovedByDefault": "Approved By Default",
287
"ApprovalDelay": "Approval Delay",
288
"ApprovalDuration": "Approval Duration",
289
"Checker": "Checker",
290
"ExtendedTimeout": "Extended Timeout",
291
"Expires": "Expires",
292
"LastCheckerStatus": "Last Checker Status",
293
}
294
295
def __init__(self, clients, keywords, tableheaders=None):
296
self.clients = clients
297
self.keywords = keywords
298
if tableheaders is not None:
299
self.tableheaders = tableheaders
300
301
def __str__(self):
302
return "\n".join(self.rows())
303
304
if sys.version_info.major == 2:
305
__unicode__ = __str__
306
def __str__(self):
307
return str(self).encode(locale.getpreferredencoding())
308
309
def rows(self):
310
format_string = self.row_formatting_string()
311
rows = [self.header_line(format_string)]
312
rows.extend(self.client_line(client, format_string)
313
for client in self.clients)
314
return rows
315
316
def row_formatting_string(self):
317
"Format string used to format table rows"
318
return " ".join("{{{key}:{width}}}".format(
319
width=max(len(self.tableheaders[key]),
320
*(len(self.string_from_client(client, key))
321
for client in self.clients)),
322
key=key)
323
for key in self.keywords)
324
325
def string_from_client(self, client, key):
326
return self.valuetostring(client[key], key)
327
328
@staticmethod
224
def print_clients(clients, keywords):
329
225
def valuetostring(value, keyword):
330
if isinstance(value, dbus.Boolean):
226
if type(value) is dbus.Boolean:
331
227
return "Yes" if value else "No"
332
228
if keyword in ("Timeout", "Interval", "ApprovalDelay",
333
229
"ApprovalDuration", "ExtendedTimeout"):
334
230
return milliseconds_to_string(value)
335
231
return str(value)
336
337
def header_line(self, format_string):
338
return format_string.format(**self.tableheaders)
339
340
def client_line(self, client, format_string):
341
return format_string.format(
342
**{key: self.string_from_client(client, key)
343
for key in self.keywords})
344
345
346
## Classes for commands.
347
348
# Abstract classes first
349
class Command(object):
350
"""Abstract class for commands"""
351
def run(self, mandos, clients):
352
"""Normal commands should implement run_on_one_client(), but
353
commands which want to operate on all clients at the same time
354
can override this run() method instead."""
355
self.mandos = mandos
356
for client in clients:
357
self.run_on_one_client(client)
358
359
class PrintCmd(Command):
360
"""Abstract class for commands printing client details"""
361
all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
362
"Created", "Interval", "Host", "KeyID",
363
"Fingerprint", "CheckerRunning", "LastEnabled",
364
"ApprovalPending", "ApprovedByDefault",
365
"LastApprovalRequest", "ApprovalDelay",
366
"ApprovalDuration", "Checker", "ExtendedTimeout",
367
"Expires", "LastCheckerStatus")
368
def run(self, mandos, clients):
369
print(self.output(clients))
370
371
class PropertyCmd(Command):
372
"""Abstract class for Actions for setting one client property"""
373
def run_on_one_client(self, client):
374
"""Set the Client's D-Bus property"""
375
client.Set(client_interface, self.property, self.value_to_set,
376
dbus_interface=dbus.PROPERTIES_IFACE)
377
378
class ValueArgumentMixIn(object):
379
"""Mixin class for commands taking a value as argument"""
380
def __init__(self, value):
381
self.value_to_set = value
382
383
class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):
384
"""Mixin class for commands taking a value argument as
385
milliseconds."""
386
@property
387
def value_to_set(self):
388
return self._vts
389
@value_to_set.setter
390
def value_to_set(self, value):
391
"""When setting, convert value to a datetime.timedelta"""
392
self._vts = string_to_delta(value).total_seconds() * 1000
393
394
# Actual (non-abstract) command classes
395
396
class PrintTableCmd(PrintCmd):
397
def __init__(self, verbose=False):
398
self.verbose = verbose
399
def output(self, clients):
400
if self.verbose:
401
keywords = self.all_keywords
402
else:
403
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
404
return str(TableOfClients(clients.values(), keywords))
405
406
class DumpJSONCmd(PrintCmd):
407
def output(self, clients):
408
data = {client["Name"]:
409
{key: self.dbus_boolean_to_bool(client[key])
410
for key in self.all_keywords}
411
for client in clients.values()}
412
return json.dumps(data, indent=4, separators=(',', ': '))
413
@staticmethod
414
def dbus_boolean_to_bool(value):
415
if isinstance(value, dbus.Boolean):
416
value = bool(value)
417
return value
418
419
class IsEnabledCmd(Command):
420
def run_on_one_client(self, client):
421
if self.is_enabled(client):
422
sys.exit(0)
423
sys.exit(1)
424
def is_enabled(self, client):
425
return client.Get(client_interface, "Enabled",
426
dbus_interface=dbus.PROPERTIES_IFACE)
427
428
class RemoveCmd(Command):
429
def run_on_one_client(self, client):
430
self.mandos.RemoveClient(client.__dbus_object_path__)
431
432
class ApproveCmd(Command):
433
def run_on_one_client(self, client):
434
client.Approve(dbus.Boolean(True),
435
dbus_interface=client_interface)
436
437
class DenyCmd(Command):
438
def run_on_one_client(self, client):
439
client.Approve(dbus.Boolean(False),
440
dbus_interface=client_interface)
441
442
class EnableCmd(PropertyCmd):
443
property = "Enabled"
444
value_to_set = dbus.Boolean(True)
445
446
class DisableCmd(PropertyCmd):
447
property = "Enabled"
448
value_to_set = dbus.Boolean(False)
449
450
class BumpTimeoutCmd(PropertyCmd):
451
property = "LastCheckedOK"
452
value_to_set = ""
453
454
class StartCheckerCmd(PropertyCmd):
455
property = "CheckerRunning"
456
value_to_set = dbus.Boolean(True)
457
458
class StopCheckerCmd(PropertyCmd):
459
property = "CheckerRunning"
460
value_to_set = dbus.Boolean(False)
461
462
class ApproveByDefaultCmd(PropertyCmd):
463
property = "ApprovedByDefault"
464
value_to_set = dbus.Boolean(True)
465
466
class DenyByDefaultCmd(PropertyCmd):
467
property = "ApprovedByDefault"
468
value_to_set = dbus.Boolean(False)
469
470
class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):
471
property = "Checker"
472
473
class SetHostCmd(PropertyCmd, ValueArgumentMixIn):
474
property = "Host"
475
476
class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):
477
property = "Secret"
478
479
class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
480
property = "Timeout"
481
482
class SetExtendedTimeoutCmd(PropertyCmd,
483
MillisecondsValueArgumentMixIn):
484
property = "ExtendedTimeout"
485
486
class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
487
property = "Interval"
488
489
class SetApprovalDelayCmd(PropertyCmd,
490
MillisecondsValueArgumentMixIn):
491
property = "ApprovalDelay"
492
493
class SetApprovalDurationCmd(PropertyCmd,
494
MillisecondsValueArgumentMixIn):
495
property = "ApprovalDuration"
232
233
# Create format string to print table rows
234
format_string = " ".join("{{{key}:{width}}}".format(
235
width = max(len(tablewords[key]),
236
max(len(valuetostring(client[key], key))
237
for client in clients)),
238
key = key)
239
for key in keywords)
240
# Print header line
241
print(format_string.format(**tablewords))
242
for client in clients:
243
print(format_string.format(**{
244
key: valuetostring(client[key], key)
245
for key in keywords }))
246
496
247
497
248
def has_actions(options):
498
249
return any((options.enable,
515
266
options.deny))
516
267
517
268
518
def commands_and_clients_from_options(args=None):
519
if args is None:
520
args=sys.argv[1:]
269
def main():
521
270
parser = argparse.ArgumentParser()
522
271
parser.add_argument("--version", action="version",
523
version="%(prog)s {}".format(version),
272
version = "%(prog)s {}".format(version),
524
273
help="show version number and exit")
525
274
parser.add_argument("-a", "--all", action="store_true",
526
275
help="Select all clients")
527
276
parser.add_argument("-v", "--verbose", action="store_true",
528
277
help="Print all fields")
529
parser.add_argument("-j", "--dump-json", action="store_true",
530
help="Dump client data in JSON format")
531
enable_disable = parser.add_mutually_exclusive_group()
532
enable_disable.add_argument("-e", "--enable", action="store_true",
533
help="Enable client")
534
enable_disable.add_argument("-d", "--disable",
535
action="store_true",
536
help="disable client")
278
parser.add_argument("-e", "--enable", action="store_true",
279
help="Enable client")
280
parser.add_argument("-d", "--disable", action="store_true",
281
help="disable client")
537
282
parser.add_argument("-b", "--bump-timeout", action="store_true",
538
283
help="Bump timeout for client")
539
start_stop_checker = parser.add_mutually_exclusive_group()
540
start_stop_checker.add_argument("--start-checker",
541
action="store_true",
542
help="Start checker for client")
543
start_stop_checker.add_argument("--stop-checker",
544
action="store_true",
545
help="Stop checker for client")
284
parser.add_argument("--start-checker", action="store_true",
285
help="Start checker for client")
286
parser.add_argument("--stop-checker", action="store_true",
287
help="Stop checker for client")
546
288
parser.add_argument("-V", "--is-enabled", action="store_true",
547
289
help="Check if client is enabled")
548
290
parser.add_argument("-r", "--remove", action="store_true",
555
297
help="Set extended timeout for client")
556
298
parser.add_argument("-i", "--interval",
557
299
help="Set checker interval for client")
558
approve_deny_default = parser.add_mutually_exclusive_group()
559
approve_deny_default.add_argument(
560
"--approve-by-default", action="store_true",
561
default=None, dest="approved_by_default",
562
help="Set client to be approved by default")
563
approve_deny_default.add_argument(
564
"--deny-by-default", action="store_false",
565
dest="approved_by_default",
566
help="Set client to be denied by default")
300
parser.add_argument("--approve-by-default", action="store_true",
301
default=None, dest="approved_by_default",
302
help="Set client to be approved by default")
303
parser.add_argument("--deny-by-default", action="store_false",
304
dest="approved_by_default",
305
help="Set client to be denied by default")
567
306
parser.add_argument("--approval-delay",
568
307
help="Set delay before client approve/deny")
569
308
parser.add_argument("--approval-duration",
572
311
parser.add_argument("-s", "--secret",
573
312
type=argparse.FileType(mode="rb"),
574
313
help="Set password blob (file) for client")
575
approve_deny = parser.add_mutually_exclusive_group()
576
approve_deny.add_argument(
577
"-A", "--approve", action="store_true",
578
help="Approve any current client request")
579
approve_deny.add_argument("-D", "--deny", action="store_true",
580
help="Deny any current client request")
314
parser.add_argument("-A", "--approve", action="store_true",
315
help="Approve any current client request")
316
parser.add_argument("-D", "--deny", action="store_true",
317
help="Deny any current client request")
581
318
parser.add_argument("--check", action="store_true",
582
319
help="Run self-test")
583
320
parser.add_argument("client", nargs="*", help="Client name")
584
options = parser.parse_args(args=args)
585
321
options = parser.parse_args()
322
586
323
if has_actions(options) and not (options.client or options.all):
587
324
parser.error("Options require clients names or --all.")
588
325
if options.verbose and has_actions(options):
589
parser.error("--verbose can only be used alone.")
590
if options.dump_json and (options.verbose
591
or has_actions(options)):
592
parser.error("--dump-json can only be used alone.")
326
parser.error("--verbose can only be used alone or with"
327
" --all.")
593
328
if options.all and not has_actions(options):
594
329
parser.error("--all requires an action.")
595
if options.is_enabled and len(options.client) > 1:
596
parser.error("--is-enabled requires exactly one client")
597
598
commands = []
599
600
if options.dump_json:
601
commands.append(DumpJSONCmd())
602
603
if options.enable:
604
commands.append(EnableCmd())
605
606
if options.disable:
607
commands.append(DisableCmd())
608
609
if options.bump_timeout:
610
commands.append(BumpTimeoutCmd(options.bump_timeout))
611
612
if options.start_checker:
613
commands.append(StartCheckerCmd())
614
615
if options.stop_checker:
616
commands.append(StopCheckerCmd())
617
618
if options.is_enabled:
619
commands.append(IsEnabledCmd())
620
621
if options.remove:
622
commands.append(RemoveCmd())
623
624
if options.checker is not None:
625
commands.append(SetCheckerCmd())
626
627
if options.timeout is not None:
628
commands.append(SetTimeoutCmd(options.timeout))
629
630
if options.extended_timeout:
631
commands.append(
632
SetExtendedTimeoutCmd(options.extended_timeout))
633
634
if options.interval is not None:
635
command.append(SetIntervalCmd(options.interval))
636
637
if options.approved_by_default is not None:
638
if options.approved_by_default:
639
command.append(ApproveByDefaultCmd())
640
else:
641
command.append(DenyByDefaultCmd())
642
643
if options.approval_delay is not None:
644
command.append(SetApprovalDelayCmd(options.approval_delay))
645
646
if options.approval_duration is not None:
647
command.append(
648
SetApprovalDurationCmd(options.approval_duration))
649
650
if options.host is not None:
651
command.append(SetHostCmd(options.host))
652
653
if options.secret is not None:
654
command.append(SetSecretCmd(options.secret))
655
656
if options.approve:
657
commands.append(ApproveCmd())
658
659
if options.deny:
660
commands.append(DenyCmd())
661
662
# If no command option has been given, show table of clients,
663
# optionally verbosely
664
if not commands:
665
commands.append(PrintTableCmd(verbose=options.verbose))
666
667
return commands, options.client
668
669
670
def main():
671
commands, clientnames = commands_and_clients_from_options()
672
330
331
if options.check:
332
fail_count, test_count = doctest.testmod()
333
sys.exit(os.EX_OK if fail_count == 0 else 1)
334
673
335
try:
674
336
bus = dbus.SystemBus()
675
337
mandos_dbus_objc = bus.get_object(busname, server_path)
676
338
except dbus.exceptions.DBusException:
677
log.critical("Could not connect to Mandos server")
339
print("Could not connect to Mandos server", file=sys.stderr)
678
340
sys.exit(1)
679
341
680
342
mandos_serv = dbus.Interface(mandos_dbus_objc,
681
dbus_interface=server_interface)
682
mandos_serv_object_manager = dbus.Interface(
683
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
684
685
# Filter out log message from dbus module
686
dbus_logger = logging.getLogger("dbus.proxies")
687
class NullFilter(logging.Filter):
688
def filter(self, record):
689
return False
690
dbus_filter = NullFilter()
691
dbus_logger.addFilter(dbus_filter)
343
dbus_interface = server_interface)
344
345
#block stderr since dbus library prints to stderr
346
null = os.open(os.path.devnull, os.O_RDWR)
347
stderrcopy = os.dup(sys.stderr.fileno())
348
os.dup2(null, sys.stderr.fileno())
349
os.close(null)
692
350
try:
693
351
try:
694
mandos_clients = {path: ifs_and_props[client_interface]
695
for path, ifs_and_props in
696
mandos_serv_object_manager
697
.GetManagedObjects().items()
698
if client_interface in ifs_and_props}
352
mandos_clients = mandos_serv.GetAllClientsWithProperties()
699
353
finally:
700
# restore dbus logger
701
dbus_logger.removeFilter(dbus_filter)
702
except dbus.exceptions.DBusException as e:
703
log.critical("Failed to access Mandos server through D-Bus:"
704
"\n%s", e)
354
#restore stderr
355
os.dup2(stderrcopy, sys.stderr.fileno())
356
os.close(stderrcopy)
357
except dbus.exceptions.DBusException:
358
print("Access denied: Accessing mandos server through dbus.",
359
file=sys.stderr)
705
360
sys.exit(1)
706
361
707
362
# Compile dict of (clients: properties) to process
708
clients = {}
709
710
if not clientnames:
711
clients = {bus.get_object(busname, path): properties
712
for path, properties in mandos_clients.items()}
363
clients={}
364
365
if options.all or not options.client:
366
clients = { bus.get_object(busname, path): properties
367
for path, properties in mandos_clients.items() }
713
368
else:
714
for name in clientnames:
369
for name in options.client:
715
370
for path, client in mandos_clients.items():
716
371
if client["Name"] == name:
717
372
client_objc = bus.get_object(busname, path)
718
373
clients[client_objc] = client
719
374
break
720
375
else:
721
log.critical("Client not found on server: %r", name)
376
print("Client not found on server: {!r}"
377
.format(name), file=sys.stderr)
722
378
sys.exit(1)
723
724
# Run all commands on clients
725
for command in commands:
726
command.run(mandos_serv, clients)
727
728
729
class Test_milliseconds_to_string(unittest.TestCase):
730
def test_all(self):
731
self.assertEqual(milliseconds_to_string(93785000),
732
"1T02:03:05")
733
def test_no_days(self):
734
self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
735
def test_all_zero(self):
736
self.assertEqual(milliseconds_to_string(0), "00:00:00")
737
def test_no_fractional_seconds(self):
738
self.assertEqual(milliseconds_to_string(400), "00:00:00")
739
self.assertEqual(milliseconds_to_string(900), "00:00:00")
740
self.assertEqual(milliseconds_to_string(1900), "00:00:01")
741
742
class Test_string_to_delta(unittest.TestCase):
743
def test_handles_basic_rfc3339(self):
744
self.assertEqual(string_to_delta("PT2H"),
745
datetime.timedelta(0, 7200))
746
def test_falls_back_to_pre_1_6_1_with_warning(self):
747
# assertLogs only exists in Python 3.4
748
if hasattr(self, "assertLogs"):
749
with self.assertLogs(log, logging.WARNING):
750
value = string_to_delta("2h")
379
380
if not has_actions(options) and clients:
381
if options.verbose:
382
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
383
"Created", "Interval", "Host", "Fingerprint",
384
"CheckerRunning", "LastEnabled",
385
"ApprovalPending", "ApprovedByDefault",
386
"LastApprovalRequest", "ApprovalDelay",
387
"ApprovalDuration", "Checker",
388
"ExtendedTimeout")
751
389
else:
752
class WarningFilter(logging.Filter):
753
"""Don't show, but record the presence of, warnings"""
754
def filter(self, record):
755
is_warning = record.levelno >= logging.WARNING
756
self.found = is_warning or getattr(self, "found",
757
False)
758
return not is_warning
759
warning_filter = WarningFilter()
760
log.addFilter(warning_filter)
761
try:
762
value = string_to_delta("2h")
763
finally:
764
log.removeFilter(warning_filter)
765
self.assertTrue(getattr(warning_filter, "found", False))
766
self.assertEqual(value, datetime.timedelta(0, 7200))
767
768
769
class TestCmd(unittest.TestCase):
770
"""Abstract class for tests of command classes"""
771
def setUp(self):
772
testcase = self
773
class MockClient(object):
774
def __init__(self, name, **attributes):
775
self.__dbus_object_path__ = "objpath_{}".format(name)
776
self.attributes = attributes
777
self.attributes["Name"] = name
778
def Set(interface, property, value,
779
properties_interface):
780
testcase.assertEqual(interface, client_interface)
781
testcase.assertEqual(properties_interface,
782
dbus.PROPERTIES_IFACE)
783
self.attributes[property] = value
784
def Get(interface, property, properties_interface):
785
testcase.assertEqual(interface, client_interface)
786
testcase.assertEqual(properties_interface,
787
dbus.PROPERTIES_IFACE)
788
return self.attributes[property]
789
def __getitem__(self, key):
790
return self.attributes[key]
791
self.clients = collections.OrderedDict([
792
("foo",
793
MockClient(
794
"foo",
795
KeyID=("92ed150794387c03ce684574b1139a65"
796
"94a34f895daaaf09fd8ea90a27cddb12"),
797
Secret=b"secret",
798
Host="foo.example.org",
799
Enabled=dbus.Boolean(True),
800
Timeout=300000,
801
LastCheckedOK="2019-02-03T00:00:00",
802
Created="2019-01-02T00:00:00",
803
Interval=120000,
804
Fingerprint=("778827225BA7DE539C5A"
805
"7CFA59CFF7CDBD9A5920"),
806
CheckerRunning=dbus.Boolean(False),
807
LastEnabled="2019-01-03T00:00:00",
808
ApprovalPending=dbus.Boolean(False),
809
ApprovedByDefault=dbus.Boolean(True),
810
LastApprovalRequest="",
811
ApprovalDelay=0,
812
ApprovalDuration=1000,
813
Checker="fping -q -- %(host)s",
814
ExtendedTimeout=900000,
815
Expires="2019-02-04T00:00:00",
816
LastCheckerStatus=0)),
817
("barbar",
818
MockClient(
819
"barbar",
820
KeyID=("0558568eedd67d622f5c83b35a115f79"
821
"6ab612cff5ad227247e46c2b020f441c"),
822
Secret=b"secretbar",
823
Host="192.0.2.3",
824
Enabled=dbus.Boolean(True),
825
Timeout=300000,
826
LastCheckedOK="2019-02-04T00:00:00",
827
Created="2019-01-03T00:00:00",
828
Interval=120000,
829
Fingerprint=("3E393AEAEFB84C7E89E2"
830
"F547B3A107558FCA3A27"),
831
CheckerRunning=dbus.Boolean(True),
832
LastEnabled="2019-01-04T00:00:00",
833
ApprovalPending=dbus.Boolean(False),
834
ApprovedByDefault=dbus.Boolean(False),
835
LastApprovalRequest="2019-01-03T00:00:00",
836
ApprovalDelay=30000,
837
ApprovalDuration=1000,
838
Checker=":",
839
ExtendedTimeout=900000,
840
Expires="2019-02-05T00:00:00",
841
LastCheckerStatus=-2)),
842
])
843
844
class TestPrintTableCmd(TestCmd):
845
def test_normal(self):
846
output = PrintTableCmd().output(self.clients)
847
expected_output = """
848
Name Enabled Timeout Last Successful Check
849
foo Yes 00:05:00 2019-02-03T00:00:00
850
barbar Yes 00:05:00 2019-02-04T00:00:00
851
"""[1:-1]
852
self.assertEqual(output, expected_output)
853
def test_verbose(self):
854
output = PrintTableCmd(verbose=True).output(self.clients)
855
expected_output = """
856
Name Enabled Timeout Last Successful Check Created Interval Host Key ID Fingerprint Check Is Running Last Enabled Approval Is Pending Approved By Default Last Approval Request Approval Delay Approval Duration Checker Extended Timeout Expires Last Checker Status
857
foo Yes 00:05:00 2019-02-03T00:00:00 2019-01-02T00:00:00 00:02:00 foo.example.org 92ed150794387c03ce684574b1139a6594a34f895daaaf09fd8ea90a27cddb12 778827225BA7DE539C5A7CFA59CFF7CDBD9A5920 No 2019-01-03T00:00:00 No Yes 00:00:00 00:00:01 fping -q -- %(host)s 00:15:00 2019-02-04T00:00:00 0
858
barbar Yes 00:05:00 2019-02-04T00:00:00 2019-01-03T00:00:00 00:02:00 192.0.2.3 0558568eedd67d622f5c83b35a115f796ab612cff5ad227247e46c2b020f441c 3E393AEAEFB84C7E89E2F547B3A107558FCA3A27 Yes 2019-01-04T00:00:00 No No 2019-01-03T00:00:00 00:00:30 00:00:01 : 00:15:00 2019-02-05T00:00:00 -2
859
"""[1:-1]
860
self.assertEqual(output, expected_output)
861
def test_one_client(self):
862
output = PrintTableCmd().output({"foo": self.clients["foo"]})
863
expected_output = """
864
Name Enabled Timeout Last Successful Check
865
foo Yes 00:05:00 2019-02-03T00:00:00
866
"""[1:-1]
867
self.assertEqual(output, expected_output)
868
869
870
871
def should_only_run_tests():
872
parser = argparse.ArgumentParser(add_help=False)
873
parser.add_argument("--check", action='store_true')
874
args, unknown_args = parser.parse_known_args()
875
run_tests = args.check
876
if run_tests:
877
# Remove --check argument from sys.argv
878
sys.argv[1:] = unknown_args
879
return run_tests
880
881
# Add all tests from doctest strings
882
def load_tests(loader, tests, none):
883
import doctest
884
tests.addTests(doctest.DocTestSuite())
885
return tests
390
keywords = defaultkeywords
391
392
print_clients(clients.values(), keywords)
393
else:
394
# Process each client in the list by all selected options
395
for client in clients:
396
397
def set_client_prop(prop, value):
398
"""Set a Client D-Bus property"""
399
client.Set(client_interface, prop, value,
400
dbus_interface=dbus.PROPERTIES_IFACE)
401
402
def set_client_prop_ms(prop, value):
403
"""Set a Client D-Bus property, converted
404
from a string to milliseconds."""
405
set_client_prop(prop,
406
string_to_delta(value).total_seconds()
407
* 1000)
408
409
if options.remove:
410
mandos_serv.RemoveClient(client.__dbus_object_path__)
411
if options.enable:
412
set_client_prop("Enabled", dbus.Boolean(True))
413
if options.disable:
414
set_client_prop("Enabled", dbus.Boolean(False))
415
if options.bump_timeout:
416
set_client_prop("LastCheckedOK", "")
417
if options.start_checker:
418
set_client_prop("CheckerRunning", dbus.Boolean(True))
419
if options.stop_checker:
420
set_client_prop("CheckerRunning", dbus.Boolean(False))
421
if options.is_enabled:
422
sys.exit(0 if client.Get(client_interface,
423
"Enabled",
424
dbus_interface=
425
dbus.PROPERTIES_IFACE)
426
else 1)
427
if options.checker is not None:
428
set_client_prop("Checker", options.checker)
429
if options.host is not None:
430
set_client_prop("Host", options.host)
431
if options.interval is not None:
432
set_client_prop_ms("Interval", options.interval)
433
if options.approval_delay is not None:
434
set_client_prop_ms("ApprovalDelay",
435
options.approval_delay)
436
if options.approval_duration is not None:
437
set_client_prop_ms("ApprovalDuration",
438
options.approval_duration)
439
if options.timeout is not None:
440
set_client_prop_ms("Timeout", options.timeout)
441
if options.extended_timeout is not None:
442
set_client_prop_ms("ExtendedTimeout",
443
options.extended_timeout)
444
if options.secret is not None:
445
set_client_prop("Secret",
446
dbus.ByteArray(options.secret.read()))
447
if options.approved_by_default is not None:
448
set_client_prop("ApprovedByDefault",
449
dbus.Boolean(options
450
.approved_by_default))
451
if options.approve:
452
client.Approve(dbus.Boolean(True),
453
dbus_interface=client_interface)
454
elif options.deny:
455
client.Approve(dbus.Boolean(False),
456
dbus_interface=client_interface)
457
886
458
887
459
if __name__ == "__main__":
888
if should_only_run_tests():
889
# Call using ./tdd-python-script --check [--verbose]
890
unittest.main()
891
else:
892
main()
460
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0